---
name: diag-vpcpeering
description: |
  Read-only diagnosis for Dedicated VPCPeering CR lifecycle (Pending/Creating/
  Failed/not Active). Use when peering name is known; checks VPC Active Gate.
---

# Action Type

`read-only`

# Path note

Shared docs resolve from skill root (`dedicated-cloud-diag/`):
`references/method-*`, `references/patterns/*`, `references/object-graph.md`.

# Data methods

- `references/method-k8s-resource/METHOD.md`

# Required patterns

`cp-cr-lifecycle`, `provider-branch`, `healthy-exit`, `fetch-retry-bypass`,
`skill-boundary-assist`, `diag-trace`. Edges: `references/object-graph.md`.

# Inputs

| Input | Required |
|-------|----------|
| VPCPeering `name` (+ ns) | hard |

# Top-down Procedure

1. Intent (hard): Plane=`CONTROL_PLANE`, GK=`VPCPeering`, name/ns.  
   Focus: `status.phase`, peering role/refs, provider.
2. `cp-cr-lifecycle` then **VPC Gate** (hard): related VPC must be `Active`
   (Guardian). If not → handoff `diag-vpc`.
3. Provider (`when provider=`):
   - **eks/aws**: Guardian → Accept **or** Connection task by `peeringRole`.
   - **gke/gcp**: Guardian → Peering task.  
   AKS peering path not in current taskbuilder — if provider aks/unknown →
   `blocked-uncertain` or code-read; do not invent steps.
4. Deeper CLI/code: `regional-server/pkg/controllers/vpcpeering/`.

# Health checklist (hard)

1. `status.phase=Active`.
2. Dependency VPC Active.

# Output

Obey `references/patterns/diag-trace.md`.